{...}: {
  # System-managed ssh-agent. Enabling startAgent runs an ssh-agent per user
  # session and exports SSH_AUTH_SOCK automatically, so the dotfiles zsh
  # `ssh-agent` bootstrap finds a reachable agent (its Linux fallback hardcodes
  # /usr/bin/ssh-agent, which does not exist on NixOS).
  flake.nixosModules.ssh-agent = {pkgs, ...}: {
    programs.ssh = {
      startAgent = true;
      # ed25519-sk / passphrase prompts route through this pinentry.
      enableAskPassword = true;
    };

    environment.systemPackages = with pkgs; [
      openssh # provides ssh-add / ssh-agent on PATH
    ];
  };
}